diff --git a/changelog b/changelog
index 0af359b2206d8c9382b2fc6661fe0ae8fbac05c1..4580d42a63e9d133b4cbcc291d723534cf6a03c0 100644
--- a/changelog
+++ b/changelog
@@ -30,6 +30,12 @@ trips around the event loop (and cgi...).
 6) MAJOR connections on ah waiting list that closed did not get removed from
 the waiting list...
 
+7) MAJOR since we added the ability to hold an ah across http keepalive
+transactions where more headers had already arrived, we broke the ability
+to tell if more headers had arrived.  Result was if the browser didn't
+close the keepalive, we retained ah for the lifetime of the keepalive,
+using up the pool.
+
 
 Changes
 -------
diff --git a/lib/parsers.c b/lib/parsers.c
index d505ee43195a891ae86abb03945286d845675ca6..e802e8ce023f4facdafac0ef97896f075b3e8afe 100644
--- a/lib/parsers.c
+++ b/lib/parsers.c
@@ -229,7 +229,7 @@ int lws_header_table_detach(struct lws *wsi)
 			    "wsi->more_rx_waiting %d\n", __func__, wsi,
 			    (int)(now - wsi->u.hdr.ah->assigned),
 			    ah->rxpos, ah->rxlen, wsi->mode, wsi->state,
-			    wsi->u.hdr.more_rx_waiting);
+			    wsi->more_rx_waiting);
 	}
 
 	/* if we think we're detaching one, there should be one in use */
diff --git a/lib/private-libwebsockets.h b/lib/private-libwebsockets.h
index a228cbc7c8568a066582807fbce24853da80e4bf..5dd4817877e1e49596fd91fd4600162b059af453 100644
--- a/lib/private-libwebsockets.h
+++ b/lib/private-libwebsockets.h
@@ -964,7 +964,6 @@ struct _lws_header_related {
 	char post_literal_equal;
 	unsigned char parser_state; /* enum lws_token_indexes */
 	char redirects;
-	char more_rx_waiting;
 };
 
 struct _lws_websocket_related {
@@ -1091,6 +1090,7 @@ struct lws {
 	unsigned int user_space_externally_allocated:1;
 	unsigned int socket_is_permanently_unusable:1;
 	unsigned int rxflow_change_to:2;
+	unsigned int more_rx_waiting:1; /* has to live here since ah may stick to end */
 #ifndef LWS_NO_EXTENSIONS
 	unsigned int extension_data_pending:1;
 #endif
diff --git a/lib/server.c b/lib/server.c
index 1711ae62b3f1cace3ee1852c17feb08ebf7c0472..bd57ad2ee139a6dd15632aee60276a849cbdf6d3 100644
--- a/lib/server.c
+++ b/lib/server.c
@@ -352,7 +352,7 @@ lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
 	assert(wsi->u.hdr.ah);
 
 	while (len--) {
-		wsi->u.hdr.more_rx_waiting = !!len;
+		wsi->more_rx_waiting = !!len;
 
 		assert(wsi->mode == LWSCM_HTTP_SERVING);
 
@@ -364,7 +364,9 @@ lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
 		if (wsi->u.hdr.parser_state != WSI_PARSING_COMPLETE)
 			continue;
 
-		lwsl_parser("lws_parse sees parsing complete\n");
+		lwsl_parser("%s: lws_parse sees parsing complete\n", __func__);
+		lwsl_debug("%s: wsi->more_rx_waiting=%d\n", __func__,
+				wsi->more_rx_waiting);
 
 		wsi->mode = LWSCM_PRE_WS_SERVING_ACCEPT;
 		lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
@@ -746,7 +748,10 @@ lws_http_transaction_completed(struct lws *wsi)
 	 * reset the existing header table and keep it.
 	 */
 	if (wsi->u.hdr.ah) {
-		if (!wsi->u.hdr.more_rx_waiting) {
+		lwsl_info("%s: wsi->more_rx_waiting=%d\n", __func__,
+				wsi->more_rx_waiting);
+
+		if (!wsi->more_rx_waiting) {
 			wsi->u.hdr.ah->rxpos = wsi->u.hdr.ah->rxlen;
 			lws_header_table_detach(wsi);
 		} else